Netclode
Run cloud coding agents in isolated microVMs on your own infrastructure and control them from native Apple clients.
- Source repo
- angristan/netclode
- Stars
- ★ 256
- Last updated
- 1mo ago
- Primary language
- Swift
- FA score
- 52/100 · Major gaps
At a glance
- Works with
- Universal · cross-platformCodex · Claude Code · OpenAI API · Claude API
- You'll need
- Typical use
- An individual developer who wants to work on repositories from an iPhone or Mac without placing the execution environment on a third-party coding-agent service.
- Main limitation
- Adopters must operate a nested-virtualization Linux VPS plus k3s, Kata Containers, Cloud Hypervisor, Redis, JuiceFS, S3, and Tailscale, creating a substantial infrastructure burden.
- Source review
- 52/100 · Major gaps 1 safety controls not found
What does this agent do, and when should you use it?
Netclode is a self-hosted cloud coding-agent system that assigns each session an isolated microVM built with Kata Containers and Cloud Hypervisor. Its Go control plane runs on k3s, allocates sandboxes from a pre-booted pool, and forwards prompts over Connect RPC to a TypeScript/Node.js SDK runner inside the sandbox. The runner supports Claude Code, OpenCode, Copilot, and Codex SDKs with providers including Anthropic, OpenAI, Mistral, and Ollama. Redis Streams retains reconnectable session events, while JuiceFS persists workspaces, installed tools, Docker images, and SDK sessions to S3 for pause, resume, snapshot, and rollback workflows. Users interact through a native SwiftUI iOS/macOS application or a Go debugging CLI, with access to diffs, a live terminal, and Tailscale-backed port previews. The deployment boundary is a self-managed Linux VPS with nested virtualization, provisioned through Ansible and operated with k3s, Tailscale, S3, and the required credentials.
The client reaches the Go control plane through Tailscale Ingress and Connect RPC. The control plane allocates a Kata VM from the agent-sandbox warm pool and sends prompts to a Claude Code, OpenCode, Copilot, or Codex SDK running inside it. Within the sandbox, the agent can work on repository files, install software, run commands with root access, use Docker, and call either configured model APIs or local Ollama inference. Responses stream back to the client, while Redis Streams persists events so a disconnected client can reconnect without losing the session. On pause, the VM is deleted and JuiceFS retains the workspace, installed tools, Docker images, and SDK session in S3; resume mounts that storage again. Netclode also records a snapshot after each turn and can roll both the workspace and chat back to an earlier point. Its GitHub integration clones private repositories, pushes commits, and creates pull requests, while the GitHub Bot handles @mentions on issues or PRs and reviews Dependabot or Renovate updates. A separate secret-proxy injects API keys for allowed hosts without placing the real credentials inside the sandbox.
- An individual developer who wants to work on repositories from an iPhone or Mac without placing the execution environment on a third-party coding-agent service.
- A team that needs agents to run Docker, install arbitrary software, and use root privileges while containing each session in a separate microVM.
- A developer with a local GPU who wants to run models through Ollama so inference does not leave the machine.
- A user maintaining many long-lived project sessions who wants paused sessions to retain state in S3 without keeping their VMs running.
- A repository maintainer who wants an @mention on a GitHub issue or pull request to launch a sandbox, or wants automated review of Dependabot and Renovate pull requests.
- A Tailscale user who needs private access to sandbox web previews, internal infrastructure, and a live terminal.
How do you install or deploy this agent?
The supplied material documents a deployment sequence but no complete copyable command set. The stated process is to provision a Linux VPS with nested virtualization, run the repository's Ansible playbooks, configure model API keys plus S3 credentials and Tailscale OAuth, deploy the Kubernetes manifests, and connect through Tailscale. The resulting installation also uses k3s, Kata Containers, Cloud Hypervisor, Redis, JuiceFS, and S3. The source does not provide the VPS sizing, exact playbook invocation, manifest deployment command, environment-variable names, or iOS/macOS client installation steps, so a complete first-run procedure cannot be reproduced from the supplied material alone.
How do you use this agent?
After deployment and Tailscale connectivity are in place, create or resume a session from the native iOS/macOS app. The control plane allocates a warm sandbox and passes prompts to the selected SDK; the app can display streamed responses and multi-repository Git diffs, open a live shell, accept speech input, and expose sandbox ports to the tailnet. Pause a session to remove its VM while retaining state through JuiceFS and S3, then resume it with the same workspace and SDK session. Per-turn snapshots can restore both the workspace and conversation to a previous point. For GitHub workflows, mention the bot on an issue or pull request to start a sandbox and receive its response as a comment. A Go debugging CLI is present, but its build, authentication, and first-invocation commands are not included in the supplied source.
What are this agent's strengths and limitations?
- Kata Containers and Cloud Hypervisor isolate every session in a microVM, allowing root access, Docker, and arbitrary tool installation inside the sandbox.
- The runner supports Claude Code, OpenCode, Copilot, and Codex across multiple remote providers, with Ollama available for local GPU inference.
- A pre-booted sandbox pool targets immediate starts, while Redis Streams preserve session events across client reconnections.
- JuiceFS-backed S3 persistence lets paused sessions release their VM while retaining the workspace, tools, Docker images, and SDK state.
- Automatic snapshots after each turn support coordinated rollback of both repository state and conversation history.
- The external secret-proxy injects API credentials only for allowed hosts, keeping real keys out of the sandbox.
- Adopters must operate a nested-virtualization Linux VPS plus k3s, Kata Containers, Cloud Hypervisor, Redis, JuiceFS, S3, and Tailscale, creating a substantial infrastructure burden.
- Deployment requires model API keys, S3 credentials, and Tailscale OAuth; private-repository and bot workflows additionally depend on GitHub App integration.
- The primary graphical client is a SwiftUI iOS 26 application that also targets macOS; no web, Windows, or Android client is documented.
- The quick-start material gives only high-level stages and omits directly executable Ansible, Kubernetes, and client-installation commands.
- The repository license is unknown, so adopters must establish their rights to use, modify, or redistribute it.
- The claim that paused sessions cost practically nothing beyond storage is not accompanied by capacity guidance, benchmarks, recovery objectives, or measured cost data.
How does this agent compare with similar options?
Key facts side by side with the most closely related agents.
| Agent | Source review | Stars | Updated | Language | Full support on |
|---|---|---|---|---|---|
| Netclode This agent | 52 · Major gaps | ★ 256 | 1mo ago | Swift | Codex · Claude Code · OpenAI API · Claude API |
| Skybridge MCP Apps Framework | 64 · Some gaps | ★ 2.1k | 1d ago | TypeScript | ChatGPT · Claude.ai |
| Omnigent | 62 · Some gaps | ★ 10k | today | Python | ChatGPT · Codex · Claude Code · Claude.ai · OpenAI API · Claude API |
| vibepanel Agent Console | 85 · Good | ★ 29 | 5d ago | Go | Codex · Claude Code |
How does FollowAgents rate this agent?
Why each dimension lost points
The README clearly maps data flows among the client, control plane, Redis, sandbox, S3, GitHub, and model APIs. It also describes per-repository GitHub tokens, out-of-sandbox API-key injection, and per-turn snapshot rollback; the Agent workflow limits permissions to contents:read and packages:write. Deductions apply because the product explicitly provides root, Docker, “full yolo mode,” infrastructure access, and automated dependency-PR reviews without showing per-action confirmation, default egress policy, or approval gates for external writes. “Secrets can't be stolen” is an absolute claim not demonstrated by the supplied implementation evidence. Lockfiles and CI checks help, but Actions are pinned only to major tags and lint uses latest. Attribution is limited to first-person authorship and a blog link; publisher identity and licensing remain unclear.
The architecture, stack, and repository layout in the README are reasonably consistent with the Node, Go, container-build, and test steps in the Agent and CLI workflows. npm ci, Go modules, and explicit runtime versions adequately support ordinary dependency availability. Deductions reflect the extensive deployment chain—k3s, Kata, Cloud Hypervisor, JuiceFS, S3, Tailscale, and nested virtualization—with no supplied compatibility matrix or dependency-failure strategy. No user-facing error messages, diagnostic examples, or failure-recovery messages are shown, so failure_messages scores 0.
The source identifies users seeking a self-hosted coding agent accessible from iPhone or Mac and covers interactive sessions, terminals, previews, GitHub mentions, dependency-update reviews, and local inference. Supported SDKs, providers, platforms, infrastructure boundaries, GitHub Bot triggers, and CI path filters are stated with useful specificity. Deductions apply because provider-specific capability differences, policy boundaries, false-trigger handling, and deployment profiles for different scales are not detailed. Environment fit is also constrained by heavyweight requirements such as nested virtualization, Tailscale, and S3-compatible storage.
The README has strong information architecture: a system diagram, stack table, repository tree, and topic-oriented documentation index justify full marks for information_architecture. Installation evidence is only a five-step outline; the linked deployment guide is not included in the supplied source, so its practical completeness cannot be credited. Naming is generally stable and demos are provided, but there is no FAQ, complete example session, or troubleshooting example. Limitations are only indirectly noted through requirements such as nested virtualization and iOS 26. No license is supplied, and there is no release scheme or changelog; SHA image tags help, but latest is also published. Maintenance responsibility is only weakly implied by first-person authorship, without a maintenance policy, support path, or update commitment.
Native clients, streaming, session restoration, diff views, a live terminal, port previews, and GitHub integration indicate outputs that can feed directly into development workflows. Combining microVM isolation, mobile access, local inference, and persistent sessions supplies meaningful incremental value, while deleting paused VMs and retaining object storage shows cost awareness. Deductions apply because benefits such as instant startup and practically cost-free paused sessions are supported mainly by README assertions and demos, without benchmarks, resource requirements, a cost model, or a verifiable comparison with alternatives.
Most capability claims are tied to named components, directories, protocols, or workflow steps. The README and CI workflows provide some corroboration for the Node/Go Agent, authentication proxy, container build, and multi-platform CLI. Deductions apply because the supplied evidence consists of one product overview and two partial workflows, leaving key implementations—secret injection, network controls, rollback, and GitHub write operations—uncorroborated. Facts, design intentions, and promotional inferences are not consistently separated, particularly for claims that secrets cannot be stolen, startup is instant, and paused sessions cost practically nothing.
- Not found in source: confirmation before actingTurn on (or add) a confirmation step before it acts, and try it in a sandbox or test environment before real data.
- “Full yolo mode” permits root, Docker, and arbitrary installation inside the sandbox; verify Kata isolation, host mounts, privileged settings, device passthrough, and container-escape defenses before deployment.
- Do not rely solely on “Secrets can't be stolen” for high-value credentials. Review proxy allowlists, request binding, log redaction, token lifetime, and leakage through approved-host forwarding or prompt injection.
- The GitHub Bot can react to mentions, push commits, create PRs, and automatically review dependency updates; verify permission scope, branch protection, human approval, webhook validation, and prompt-injection defenses.
- Deployment depends on nested virtualization, k3s, Kata, Cloud Hypervisor, JuiceFS, S3, Redis, and Tailscale. Independently validate compatibility, upgrade paths, backups, and disaster recovery before production use.
- No license is supplied; clarify rights before copying, modifying, deploying, or redistributing the software.